{"openapi":"3.0.3","info":{"title":"OT Intel API","version":"2.0.0","description":"OT/ICS/SCADA threat intelligence for AI agents and industrial SOC automation. 40 pay-per-call endpoints across primitive, analytical, and composed-synthesis tiers, covering CVE triage, internet-exposed device lookup, ICS threat actor profiles (SANDWORM, VOLTZITE, XENOTIME), IOC enrichment with OT campaign context, CISA ICS-CERT advisory feed, patch feasibility assessment, asset risk verdict (escalate:true/false), active campaign tracker, sector change feed, ICS malware encyclopedia (PIPEDREAM, TRITON, INDUSTROYER2), sector threat brief, ASN infrastructure profiling, YARA/Sigma detection artifacts, multi-framework compliance gap mapping across NERC CIP, IEC 62443, NIST CSF, CISA CPG, Saudi NCA OTCC, and UAE NESA IA, a deterministic capability x opportunity x intent threat score, third-party vendor risk, D3FEND-mapped mitigation guidance, board/GRC portfolio risk aggregation, a remediation action risk gate, and AI/agentic copilot attack-surface exposure. All data is AI-enriched by DeepSeek with OT-adjusted severity, cyber-physical impact, MITRE ATT&CK for ICS technique mapping, and CISA KEV status. Data sources: NVD, CISA ICS-CERT, MITRE ATT&CK ICS, AlienVault OTX, AbuseIPDB, Dragos, Claroty Team82, Nozomi Networks Labs, GDELT, OFAC. No API key — USDC micropayments on Base mainnet via x402.","contact":{"name":"OT Intel API","email":"nino@senwan.io"},"x-logo":{"url":"https://ot-intel.daligence.com/icon.png","altText":"OT Intel API"},"x-payment":{"protocol":"x402","network":"eip155:8453","asset":"USDC"}},"servers":[{"url":"https://ot-intel.daligence.com","description":"OT Intel API — production"}],"x-skill-url":"https://ot-intel.daligence.com/SKILL.md","x-a2a-url":"https://ot-intel.daligence.com/a2a","x-mcp-url":"https://ot-intel.daligence.com/mcp","paths":{"/ot/cve":{"get":{"summary":"OT-Contextualised CVE Triage","description":"CVE lookup enriched for ICS/SCADA environments. Returns OT-adjusted severity, cyber-physical impact, affected ICS layer, compensating controls, patch feasibility, and CISA KEV status.","operationId":"getCveTriage","tags":["CVE","Vulnerability"],"x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.02"}},"parameters":[{"name":"id","in":"query","required":true,"schema":{"type":"string"},"description":"CVE identifier e.g. CVE-2023-38802"}],"responses":{"200":{"description":"OT CVE intelligence report"},"402":{"description":"Payment required — x402 USDC on Base mainnet"}}}},"/ot/device":{"get":{"summary":"OT Device Security Profile","description":"Security profile for an OT device: its NVD CVEs (newest first), its CISA ICS advisories (full CSAF history), and a model-written hardening profile (default-credential risk, OT protocols at risk, hardening steps; labelled by profile_provenance). Not an internet exposure scan.","operationId":"getDeviceExposure","tags":["Device","Exposure"],"x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.05"}},"parameters":[{"name":"vendor","in":"query","required":true,"schema":{"type":"string"},"description":"Vendor e.g. siemens, schneider, rockwell, honeywell, unitronics, ge, beckhoff"},{"name":"model","in":"query","required":false,"schema":{"type":"string"},"description":"Device model e.g. s7-1200, modicon-m340, controllogix, vision. With a model, NVD is searched for the model name"}],"responses":{"200":{"description":"Device security profile"},"400":{"description":"vendor missing (not charged)"},"402":{"description":"Payment required"}}}},"/ot/actor":{"get":{"summary":"ICS Threat Actor Profile","description":"ICS/APT threat actor profiles grounded in published vendor research. MITRE ATT&CK for ICS techniques, known malware, attribution, physical impact, targeted sectors. Alias lookup: Volt Typhoon→VOLTZITE, APT44→SANDWORM.","operationId":"getThreatActor","tags":["Threat Actor","APT"],"x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.03"}},"parameters":[{"name":"name","in":"query","required":true,"schema":{"type":"string"},"description":"Actor name or alias e.g. SANDWORM, VOLTZITE, XENOTIME, Volt Typhoon"}],"responses":{"200":{"description":"Threat actor intelligence profile"},"402":{"description":"Payment required"}}}},"/ot/actor/sector":{"get":{"summary":"Threat Actors by Industrial Sector","description":"All ICS threat actors targeting a specific industrial sector from live MITRE ATT&CK ICS STIX data.","operationId":"getActorsBySector","tags":["Threat Actor","Sector"],"x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.03"}},"parameters":[{"name":"sector","in":"query","required":true,"schema":{"type":"string"},"description":"Sector e.g. energy, water, manufacturing, oil-and-gas, chemical, nuclear"}],"responses":{"200":{"description":"Sector actor mapping"},"402":{"description":"Payment required"}}}},"/ot/ioc":{"get":{"summary":"IOC Enrichment with OT Campaign Context","description":"IOC enrichment via AlienVault OTX and AbuseIPDB. Returns verdict on whether the IOC is linked to ICS-targeting campaigns.","operationId":"getIocEnrichment","tags":["IOC","Threat Intel"],"x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.01"}},"parameters":[{"name":"value","in":"query","required":true,"schema":{"type":"string"},"description":"IP address or domain"},{"name":"type","in":"query","required":true,"schema":{"type":"string","enum":["ip","domain"]},"description":"IOC type: ip or domain"}],"responses":{"200":{"description":"IOC enrichment result"},"402":{"description":"Payment required"}}}},"/ot/advisory":{"get":{"summary":"CISA ICS-CERT Advisory Feed","description":"CISA ICS advisories by vendor or sector from CISA's full CSAF history (since 2010), newest first. CVSS from the advisory, missing scores from NVD. Returns advisory IDs, CVE scores, vendors, CISA sectors, OT severity and triage links. One of vendor or sector is required.","operationId":"getAdvisories","tags":["CISA","Advisory"],"x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.02"}},"parameters":[{"name":"vendor","in":"query","required":false,"schema":{"type":"string"},"description":"Vendor filter e.g. siemens, schneider, rockwell"},{"name":"sector","in":"query","required":false,"schema":{"type":"string"},"description":"Sector filter e.g. energy, water, manufacturing"},{"name":"since","in":"query","required":false,"schema":{"type":"string","format":"date"},"description":"Only advisories first published on or after this date (YYYY-MM-DD)"},{"name":"model","in":"query","required":false,"schema":{"type":"string"},"description":"Your device model (e.g. s7-1500): advisories naming it first, and asset_match per advisory"},{"name":"firmware","in":"query","required":false,"schema":{"type":"string"},"description":"Your firmware version (e.g. 2.9.2), used with model: affected | related_product | not_affected | version_unknown | model_not_listed"},{"name":"limit","in":"query","required":false,"schema":{"type":"integer","default":10,"maximum":25},"description":"Page size, default 10, max 25"}],"responses":{"200":{"description":"CISA advisory list"},"400":{"description":"vendor and sector both missing, or since is not a date (not charged)"},"402":{"description":"Payment required"},"503":{"description":"CISA unreachable (not charged)"}}}},"/ot/patch":{"get":{"summary":"OT Patch Feasibility Assessment","description":"Full patch feasibility for a CVE in OT/ICS environments. Returns patch availability, OT-safe workarounds, estimated downtime, safe-to-patch-live flag, and risk-vs-disruption score (1-10).","operationId":"getPatchFeasibility","tags":["Patch","Vulnerability"],"x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.05"}},"parameters":[{"name":"id","in":"query","required":true,"schema":{"type":"string"},"description":"CVE identifier e.g. CVE-2021-34527"}],"responses":{"200":{"description":"Patch feasibility assessment"},"402":{"description":"Payment required"}}}},"/ot/exposure":{"get":{"summary":"Asset Risk Score and Escalation Verdict","description":"Synthesises vendor, model, firmware, sector, and network context into a branchable risk verdict. Returns risk_score (0-100), escalate (boolean), recommended_action, and contributing threat actors.","operationId":"getAssetExposure","tags":["Risk","Asset"],"x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.05"}},"parameters":[{"name":"vendor","in":"query","required":true,"schema":{"type":"string"},"description":"e.g. siemens, schneider, rockwell, ge, honeywell"},{"name":"model","in":"query","required":true,"schema":{"type":"string"},"description":"e.g. s7-1500, modicon-m340, controllogix"},{"name":"sector","in":"query","required":true,"schema":{"type":"string"},"description":"energy | water | manufacturing | oil-and-gas | chemical | nuclear"},{"name":"network","in":"query","required":true,"schema":{"type":"string"},"description":"internet-facing | dmz | lan-only | air-gapped"},{"name":"firmware","in":"query","required":false,"schema":{"type":"string"},"description":"Firmware version e.g. 2.9.2 — enables firmware-specific CVE matching"}],"responses":{"200":{"description":"Asset risk verdict"},"402":{"description":"Payment required"}}}},"/ot/campaign":{"get":{"summary":"Active ICS Campaign Tracker","description":"Active campaigns targeting a specific industrial sector. Returns campaign name, attributed actor, start date, targeted geography, TTPs in use, and CVEs being exploited.","operationId":"getCampaigns","tags":["Campaign","Threat Intel"],"x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.05"}},"parameters":[{"name":"sector","in":"query","required":true,"schema":{"type":"string"},"description":"energy | water | manufacturing | oil-and-gas | electric | nuclear | chemical"},{"name":"status","in":"query","required":false,"schema":{"type":"string","enum":["active","all"],"default":"active"},"description":"active (default) or all"}],"responses":{"200":{"description":"Active campaign list"},"402":{"description":"Payment required"}}}},"/ot/delta":{"get":{"summary":"Sector Change Feed","description":"What is NEW for a sector in the last N days — new CVEs, new CISA advisories, new actor activity. Designed for cron-based monitoring agents. Only returns changes.","operationId":"getSectorDelta","tags":["Change Feed","Monitoring"],"x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.03"}},"parameters":[{"name":"sector","in":"query","required":true,"schema":{"type":"string"},"description":"Sector to monitor e.g. energy, water, manufacturing"},{"name":"days","in":"query","required":false,"schema":{"type":"integer","default":7,"maximum":30},"description":"Lookback window in days, default 7"}],"responses":{"200":{"description":"Sector change delta"},"402":{"description":"Payment required"}}}},"/ot/malware":{"get":{"summary":"ICS Malware Encyclopedia","description":"Structured profiles of known ICS malware: PIPEDREAM, TRITON, INDUSTROYER2, CRASHOVERRIDE, FROSTYLOOP, BLACKENERGY. Returns capabilities, targeted OT protocols, attributed actor, and MITRE ATT&CK for ICS techniques.","operationId":"getMalwareProfile","tags":["Malware","ICS"],"x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.02"}},"parameters":[{"name":"name","in":"query","required":true,"schema":{"type":"string"},"description":"Malware name e.g. PIPEDREAM, TRITON, INDUSTROYER2, CRASHOVERRIDE"}],"responses":{"200":{"description":"ICS malware profile"},"402":{"description":"Payment required"}}}},"/ot/brief":{"get":{"summary":"Sector Threat Brief","description":"Complete 30-day threat brief for an industrial sector. Returns active actors, new CVE counts, active campaigns, top advisories, risk trend (increasing/stable/decreasing), and top 3 recommended actions. One call replaces 5+ chained calls.","operationId":"getSectorBrief","tags":["Threat Brief","Sector Report"],"x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.10"}},"parameters":[{"name":"sector","in":"query","required":true,"schema":{"type":"string"},"description":"Sector e.g. energy, water, manufacturing, oil-and-gas, nuclear"},{"name":"period","in":"query","required":false,"schema":{"type":"integer","default":30},"description":"Reporting period in days, default 30"}],"responses":{"200":{"description":"Sector threat brief"},"402":{"description":"Payment required"}}}},"/ot/asn":{"get":{"summary":"ICS Threat Actor ASN Infrastructure Profiling","description":"Profiles an ASN for ICS threat actor infrastructure use. Returns actor associations (SANDWORM, VOLTZITE, XENOTIME), phishing kit links (Tycoon2FA, EvilProxy, NakedPages), bulletproof hosting indicators, abuse categories (c2, staging, phishing), and an OT-specific blocking recommendation with WAF rule hint.","operationId":"getAsnProfile","tags":["ASN","Infrastructure","Threat Actor"],"x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.03"}},"parameters":[{"name":"asn","in":"query","required":true,"schema":{"type":"string"},"description":"ASN identifier e.g. AS215540, AS9009, AS29802"},{"name":"org","in":"query","required":false,"schema":{"type":"string"},"description":"Optional org name fragment e.g. hivelocity, m247"}],"responses":{"200":{"description":"ASN threat intelligence profile"},"402":{"description":"Payment required"}}}},"/ot/detection":{"get":{"summary":"ICS Detection Artifact Retrieval","description":"Returns YARA/Sigma detection rules for an ICS malware family or threat actor. Rules sourced from public corpus (Florian Roth signature-base, CISA advisories) are marked validated:true and safe for staging. DeepSeek-synthesised rules carry validated:false and require lab testing. Designed for automated threat hunting pipelines that commit rules to SIEMs and EDRs.","operationId":"getDetectionArtifacts","tags":["Detection","YARA","Sigma","Threat Hunting"],"x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.05"}},"parameters":[{"name":"target","in":"query","required":true,"schema":{"type":"string"},"description":"Malware or actor name e.g. PIPEDREAM, INDUSTROYER2, TRITON, SANDWORM, CHERNOVITE"},{"name":"format","in":"query","required":false,"schema":{"type":"string","enum":["yara","sigma","snort","all"],"default":"all"},"description":"Rule format filter (default: all)"}],"responses":{"200":{"description":"Detection artifact set with validated flag per rule"},"402":{"description":"Payment required"}}}},"/ot/compliance":{"get":{"summary":"Multi-Framework Compliance Gap Mapping","description":"Returns triggered compliance controls for a CVE or threat actor across 11 frameworks: NERC CIP, IEC 62443 (2-1/2-4/3-2/3-3/4-2), NIST 800-82, NIST CSF 2.0, CISA CPG, Saudi NCA OTCC, and UAE NESA IA. Deterministic table lookup — LLM only adds compensating control prose. Designed for automated compliance reporting agents: call when a new advisory drops, generate gap report, route to compliance team.","operationId":"getComplianceMapping","tags":["Compliance","NERC CIP","IEC 62443","NIST CSF","NCA OTCC","NESA IA","Audit"],"x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.04"}},"parameters":[{"name":"cve_id","in":"query","required":false,"schema":{"type":"string"},"description":"CVE identifier e.g. CVE-2023-38802"},{"name":"actor","in":"query","required":false,"schema":{"type":"string"},"description":"Threat actor name e.g. SANDWORM, VOLTZITE, XENOTIME"},{"name":"framework","in":"query","required":false,"schema":{"type":"string","enum":["nerc_cip","iec_62443_2_1","iec_62443_2_4","iec_62443_3_2","iec_62443_3_3","iec_62443_4_2","nist_800_82","nist_csf","cisa_cpg","nca_otcc","uae_nesa_ia","all"],"default":"all"},"description":"Optional filter to one compliance framework. Omit or pass 'all' to return matches across every framework."}],"responses":{"200":{"description":"Triggered compliance controls with action_required and compensating_control"},"402":{"description":"Payment required"}}}},"/ot/compliance/batch":{"get":{"summary":"Aggregate Compliance Gap Assessment","description":"Rolls up compliance-gap mapping across multiple CVEs/threat actors in a single call. Deterministic per-item table lookup against the same compliance_mappings data as /ot/compliance, deduplicated and rolled up into one aggregate severity rating. LLM only writes the remediation summary prose.","operationId":"getComplianceBatch","tags":["Compliance","NERC CIP","IEC 62443","NIST CSF","NCA OTCC","NESA IA","Audit","Batch"],"x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.20"}},"parameters":[{"name":"items","in":"query","required":true,"schema":{"type":"string"},"description":"Comma-separated CVE IDs and/or actor names, max 25, e.g. CVE-2023-38802,CVE-2024-12345,SANDWORM,XENOTIME. Each token auto-detected as a CVE ID or treated as an actor name."},{"name":"framework","in":"query","required":false,"schema":{"type":"string","enum":["nerc_cip","iec_62443_2_1","iec_62443_2_4","iec_62443_3_2","iec_62443_3_3","iec_62443_4_2","nist_800_82","nist_csf","cisa_cpg","nca_otcc","uae_nesa_ia","all"],"default":"all"},"description":"Optional filter to one compliance framework."},{"name":"entity_sector","in":"query","required":false,"schema":{"type":"string","enum":["ENERGY","WATER","TRANSPORTATION","GOVERNMENT"]},"description":"Informs the remediation summary's tone/priority framing only — does not filter which controls match."}],"responses":{"200":{"description":"Deduplicated triggered controls, aggregate compliance_gap_severity, per-item breakdown, and remediation summary"},"402":{"description":"Payment required"}}}},"/ot/threat-score":{"get":{"summary":"Actor-Target Threat Score (Capability x Opportunity x Intent)","description":"Deterministic capability x opportunity x intent threat score for an actor-target pairing. Scored from actor/CVE/campaign data plus GDELT geopolitical tension and OFAC sanctions pressure. Not LLM-generated.","operationId":"getThreatScore","tags":["Threat Score","Risk Scoring"],"x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.04"}},"parameters":[{"name":"actor","in":"query","required":true,"schema":{"type":"string"},"description":"ICS threat actor name e.g. SANDWORM, VOLTZITE, XENOTIME"},{"name":"sector","in":"query","required":true,"schema":{"type":"string"},"description":"Target sector e.g. energy, water, manufacturing"},{"name":"region","in":"query","required":true,"schema":{"type":"string"},"description":"Target region or country e.g. Europe, GCC, Ukraine"},{"name":"vendor_stack","in":"query","required":true,"schema":{"type":"string"},"description":"Comma-separated OT/ICS vendors in the target environment e.g. Siemens,Schneider Electric. Pass 'none' if unknown."}],"responses":{"200":{"description":"Threat score with capability/opportunity/intent breakdown"},"402":{"description":"Payment required"}}}},"/ot/precursor-ttp":{"get":{"summary":"Precursor / Dwell-Time TTP Breakdown","description":"Buckets an actor's known ATT&CK-for-ICS TTPs into pre-impact (reconnaissance through command-and-control — the early-warning window before physical/process disruption) vs impact-stage (inhibit-response-function, impair-process-control, impact). Deterministic tactic-taxonomy lookup against intel.db — no LLM in the classification path.","operationId":"getPrecursorTtp","tags":["TTP Analysis","Dwell Time","Early Warning","MITRE ATT&CK ICS"],"x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.04"}},"parameters":[{"name":"actor","in":"query","required":true,"schema":{"type":"string"},"description":"ICS threat actor name e.g. SANDWORM, VOLTZITE, XENOTIME"}],"responses":{"200":{"description":"Pre-impact vs impact-stage TTP breakdown with early-warning assessment"},"402":{"description":"Payment required"}}}},"/ot/xai/root-cause-localization":{"get":{"summary":"Statistical Anomaly Attribution","description":"Ranks which sensors most likely drove a reported anomaly by z-score deviation from each sensor's own baseline, given a caller-supplied telemetry window. Fully deterministic, no LLM, no trained model. Statistical approximation inspired by Oswal et al. 2025 (kernel SHAP + TCAE) — not a SHAP/TCAE reimplementation.","operationId":"getRootCauseLocalization","tags":["Anomaly Detection","Root Cause","ICS","SCADA","Statistical"],"x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.15"}},"parameters":[{"name":"window","in":"query","required":true,"schema":{"type":"string"},"description":"URL-encoded JSON array, max 20 entries: [{sensor_id, values[], baseline_mean?, baseline_stddev?}]"},{"name":"top_k","in":"query","required":false,"schema":{"type":"integer","default":5},"description":"How many ranked sensors to return"},{"name":"anomaly_event_id","in":"query","required":false,"schema":{"type":"string"},"description":"Optional correlation ID, echoed back unchanged"}],"responses":{"200":{"description":"Ranked sensor attribution by z-score deviation"},"402":{"description":"Payment required"}}}},"/ot/agentic/threat-hunt/control-loop":{"get":{"summary":"Advisory Threat Hunt (Control-Loop Recon / RMM-LOTL)","description":"Flags control-loop recon patterns and living-off-the-land/RMM-tool abuse from caller-submitted process/command observations. Fully deterministic keyword-pattern matching, no LLM. Grounded in CyberAgentX and AgenticCyOps (arXiv 2603.09134). ADVISORY ONLY — never executes containment or any network action.","operationId":"getThreatHuntControlLoop","tags":["Threat Hunting","Advisory","RMM Abuse","Living Off The Land","ICS","Control Loop"],"x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.15"}},"parameters":[{"name":"observed_processes","in":"query","required":false,"schema":{"type":"string"},"description":"Comma-separated process/tool names observed. At least one of observed_processes or observed_commands is required."},{"name":"observed_commands","in":"query","required":false,"schema":{"type":"string"},"description":"Comma-separated command strings observed. Must not contain literal commas within a command."},{"name":"zone","in":"query","required":false,"schema":{"type":"string","enum":["OT","IT","DMZ"]},"description":"Asset zone. Any RMM/LOTL match on OT is always scored HIGH."}],"responses":{"200":{"description":"Matched indicators, risk score/level, and canned recommendations"},"402":{"description":"Payment required"}}}},"/ot/physics/invariant-reachability":{"get":{"summary":"Physical Invariant Check","description":"Checks whether a tank/vessel's reported level change is physically consistent with its reported flow-in/flow-out via conservation of mass. Fully deterministic, no LLM, no trained model. Inspired by Barbhaya et al. 2025's physical-invariant residual check — flags inconsistency and direction, does not assert a specific cause.","operationId":"getInvariantReachability","tags":["Physical Invariant","Mass Balance","ICS","SCADA","Anomaly Detection"],"x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.20"}},"parameters":[{"name":"asset_id","in":"query","required":true,"schema":{"type":"string"},"description":"Identifier for the tank/vessel being checked"},{"name":"flow_in","in":"query","required":true,"schema":{"type":"number"},"description":"Metered inflow rate"},{"name":"flow_out","in":"query","required":true,"schema":{"type":"number"},"description":"Metered outflow rate"},{"name":"level_start","in":"query","required":true,"schema":{"type":"number"},"description":"Level reading at start of interval"},{"name":"level_end","in":"query","required":true,"schema":{"type":"number"},"description":"Level reading at end of interval"},{"name":"dt_seconds","in":"query","required":true,"schema":{"type":"number"},"description":"Interval duration in seconds, must be > 0"},{"name":"tank_area","in":"query","required":true,"schema":{"type":"number"},"description":"Cross-sectional area, must be > 0"},{"name":"noise_floor","in":"query","required":false,"schema":{"type":"number","default":0.5},"description":"Residual magnitude below which reading is treated as consistent"}],"responses":{"200":{"description":"Mass-balance residual, violation flag, direction, and plausible explanations"},"402":{"description":"Payment required"}}}},"/ot/vendor-risk":{"get":{"summary":"OT/ICS Third-Party Vendor Risk Assessment","description":"OT/ICS supply-chain vendor risk assessment. Returns risk tier, confidence, cited CVEs (KEV/EPSS), threat actors with historical targeting interest, and supply-chain mitigation recommendations. DeepSeek-synthesised, ICD-203 language.","operationId":"getVendorRisk","tags":["Vendor Risk","Supply Chain"],"x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.15"}},"parameters":[{"name":"vendor","in":"query","required":true,"schema":{"type":"string"},"description":"OT/ICS vendor name e.g. Schneider Electric, Siemens, Rockwell Automation"},{"name":"product","in":"query","required":false,"schema":{"type":"string"},"description":"Optional product line filter e.g. Modicon, SIMATIC"}],"responses":{"200":{"description":"Vendor risk assessment"},"402":{"description":"Payment required"}}}},"/ot/risk-exposure":{"get":{"summary":"Board/GRC-Level Portfolio Risk Aggregator","description":"Aggregates the same deterministic capability x opportunity x intent scoring used by /ot/threat-score across the actors relevant to a sector+region, ranks them, and returns a DeepSeek-written executive summary (BLUF, ICD-203 language). Portfolio-level companion to /ot/threat-score — for vCISO agents and GRC/board-reporting automation.","operationId":"getRiskExposure","tags":["Risk Exposure","GRC","Board Report"],"x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.40"}},"parameters":[{"name":"sector","in":"query","required":true,"schema":{"type":"string"},"description":"Target sector e.g. energy, water, manufacturing"},{"name":"region","in":"query","required":true,"schema":{"type":"string"},"description":"Target region e.g. GCC, KSA, UAE, Qatar, Europe"},{"name":"compliance_framework","in":"query","required":false,"schema":{"type":"string"},"description":"Optional — framework to note qualitatively in the narrative e.g. NIST_CSF_2_0, IEC_62443_3_2"},{"name":"timeframe","in":"query","required":false,"schema":{"type":"string","default":"90d"},"description":"Optional lookback window, default 90d"},{"name":"vendor_stack","in":"query","required":false,"schema":{"type":"string"},"description":"Optional comma-separated vendor list e.g. 'Schneider Modicon,Siemens SIMATIC' — feeds each actor's capability score, same as /ot/threat-score"}],"responses":{"200":{"description":"Portfolio risk aggregation with executive summary"},"402":{"description":"Payment required"}}}},"/ot/action-conformance":{"get":{"summary":"Remediation Action Risk Gate","description":"Deterministic auto_approve/human_review/reject verdict for a planned remediation action (block_ip, quarantine_host, halt_pipeline, etc.) against an actor/sector/region context. Built on the same capability x opportunity x intent scoring as /ot/threat-score, with auditable rules layered on top — no LLM in the decision path. auto_approve requires vendor_stack; omitting it caps the verdict at human_review regardless of score.","operationId":"getActionConformance","tags":["Governance","Remediation","Risk Gate"],"x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.12"}},"parameters":[{"name":"actor","in":"query","required":true,"schema":{"type":"string"},"description":"ICS threat actor name e.g. SANDWORM, VOLTZITE, XENOTIME"},{"name":"sector","in":"query","required":true,"schema":{"type":"string"},"description":"Target sector e.g. energy, water, manufacturing"},{"name":"region","in":"query","required":true,"schema":{"type":"string"},"description":"Target region e.g. GCC, KSA, UAE, Europe"},{"name":"planned_action","in":"query","required":true,"schema":{"type":"string","enum":["block_ip","block_domain","quarantine_host","isolate_segment","halt_pipeline","disable_account"]},"description":"The remediation action being gated"},{"name":"asset_context","in":"query","required":false,"schema":{"type":"string"},"description":"Optional free text, e.g. 'shared_infra:cloudflare' — escalates to human_review when shared cloud/CDN infra is detected"},{"name":"vendor_stack","in":"query","required":false,"schema":{"type":"string"},"description":"Comma-separated vendor list e.g. 'Schneider Modicon,Siemens SIMATIC'. REQUIRED for auto_approve to be reachable at all; omitting it caps the verdict at human_review."}],"responses":{"200":{"description":"Risk gate verdict: auto_approve, human_review, or reject"},"402":{"description":"Payment required"}}}},"/ot/ai-exposure":{"get":{"summary":"AI/Agentic Copilot Attack Surface Lookup","description":"AI/agentic copilot exposure lookup for OT/ICS vendors. Returns the vendor's documented AI/agentic copilot, autonomy level (advisory vs agentic — the key risk differentiator), access, and applicable MITRE ATLAS techniques. Hand-verified mapping, ATLAS IDs confirmed against the live atlas.mitre.org matrix. Deterministic, no LLM in the lookup path.","operationId":"getAiExposure","tags":["AI Security","Agentic AI","MITRE ATLAS"],"x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.20"}},"parameters":[{"name":"vendor","in":"query","required":true,"schema":{"type":"string"},"description":"OT/ICS vendor name e.g. Siemens, Schneider Electric, Rockwell Automation, ABB, Emerson, Honeywell, Yokogawa, GE Vernova, Omron, Mitsubishi Electric"}],"responses":{"200":{"description":"AI/agentic copilot exposure profile with MITRE ATLAS mappings"},"402":{"description":"Payment required"}}}},"/ot/ai-uplift":{"get":{"summary":"Attacker AI-Uplift Exposure","description":"Assesses how much a general-purpose AI agent lowers the skill/time barrier for an attacker to reach a vendor's OT-adjacent footprint. Grounded in a real-world precedent (Dragos, May 2026), not frontier-model governance thresholds. Distinct from /ot/ai-exposure, which covers a vendor's OWN embedded AI copilot. DeepSeek-synthesised, ICD-203 estimative language.","operationId":"getAiUplift","tags":["AI Uplift","AI Security","Reconnaissance"],"x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.20"}},"parameters":[{"name":"vendor","in":"query","required":true,"schema":{"type":"string"},"description":"OT/ICS vendor name e.g. Schneider Electric, Siemens, Rockwell Automation"},{"name":"product","in":"query","required":false,"schema":{"type":"string"},"description":"Optional product line filter e.g. Modicon, SIMATIC"},{"name":"internet_facing","in":"query","required":false,"schema":{"type":"string"},"description":"true, false, or unknown (default)"},{"name":"auth_type","in":"query","required":false,"schema":{"type":"string"},"description":"single-factor, mfa, or unknown (default)"},{"name":"segmented","in":"query","required":false,"schema":{"type":"string"},"description":"true, false, or unknown (default). If all three deployment-context params are unknown, the tier is capped at informational."}],"responses":{"200":{"description":"AI-uplift exposure assessment"},"402":{"description":"Payment required"}}}},"/ot/ai-attack-feasibility":{"get":{"summary":"LLM-Generated ICS Attack Feasibility","description":"Deterministic lookup against one specific empirical study (Cook, Stoica, Shah & Pezaros, ACM Trans. Priv. Sec. 29, 3, Article 31, June 2026) testing whether off-the-shelf general-purpose LLMs can generate working attack code against real PLCs. Only 3 vendors tested (Siemens, Schneider Electric, Rockwell Automation); only Network/Register-Tags techniques ever succeeded (zero for Application Code/Firmware); 1.08% overall end-to-end success rate. Claude models were excluded by the paper's own authors due to stronger safety guardrails. Distinct from /ot/ai-exposure (vendor's own AI copilot) and /ot/ai-uplift (open-ended reconnaissance-uplift synthesis). Deterministic, no LLM in the lookup path.","operationId":"getAiAttackFeasibility","tags":["AI Security","LLM Attack Synthesis","MITRE ICS"],"x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.20"}},"parameters":[{"name":"technique","in":"query","required":false,"schema":{"type":"string"},"description":"MITRE ICS technique name or ID, e.g. 'Brute Force I/O' or T0806. At least one of technique, vendor, or campaign required."},{"name":"vendor","in":"query","required":false,"schema":{"type":"string"},"description":"Siemens, Schneider Electric, or Rockwell Automation — only these three were tested in the study."},{"name":"campaign","in":"query","required":false,"schema":{"type":"string"},"description":"Industroyer2, Fuxnet, FrostyGoop, INCONTROLLER, Stuxnet, or Triton."}],"responses":{"200":{"description":"LLM-attack-feasibility finding for the requested technique/vendor/campaign"},"402":{"description":"Payment required"}}}},"/ot/claim-reliability":{"get":{"summary":"CTI Claim Reliability Scoring","description":"Grounded in Meng et al., 'Uncovering Vulnerabilities of LLM-Assisted Cyber Threat Intelligence' (arXiv:2509.23573v3, Feb 2026). Classifies a CTI claim against the paper's three failure modes — spurious correlation, contradictory knowledge, constrained generalization — using intel.db grounding plus DeepSeek synthesis. Returns a reliability score, verdict, corroborating/contradicting evidence, and confidence.","operationId":"getClaimReliability","tags":["CTI Reliability","Evidence Verification","Empirical Study"],"x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.20"}},"parameters":[{"name":"claim","in":"query","required":true,"schema":{"type":"string"},"description":"The CTI claim to assess, e.g. an actor-targeting, attribution, or TTP claim."},{"name":"actor","in":"query","required":false,"schema":{"type":"string"},"description":"Optional actor name to ground the claim against intel.db, e.g. SANDWORM."},{"name":"cve_id","in":"query","required":false,"schema":{"type":"string"},"description":"Optional CVE ID to ground the claim against intel.db."}],"responses":{"200":{"description":"Reliability assessment with verdict, score, and failure-mode flags"},"402":{"description":"Payment required"}}}},"/ot/stix-coverage":{"get":{"summary":"STIX Representability + Actionability Lookup","description":"Deterministic lookup grounded in Hahn, Krief et al., 'An Evidence-Driven Analysis of Threat Information Sharing Challenges for Industrial Control Systems' (arXiv:2512.18714v3, Jan 2026). Returns whether STIX 2.1 can represent a given technique/protocol/CVE's artifacts (full/partial/none) and whether public reporting gave enough technical detail to be actionable for detection engineering. No LLM in the lookup path.","operationId":"getStixCoverage","tags":["STIX","Threat Information Sharing","Empirical Study"],"x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.20"}},"parameters":[{"name":"technique_id","in":"query","required":false,"schema":{"type":"string"},"description":"MITRE ATT&CK ICS technique ID, e.g. T0836. At least one of technique_id, protocol, or cve_id is required."},{"name":"campaign","in":"query","required":false,"schema":{"type":"string"},"description":"Optional filter: Triton, Stuxnet, or Industroyer."},{"name":"protocol","in":"query","required":false,"schema":{"type":"string"},"description":"ICS protocol name, e.g. TriStation, S7Comm, CIP. At least one of technique_id, protocol, or cve_id is required."},{"name":"cve_id","in":"query","required":false,"schema":{"type":"string"},"description":"CVE ID from the paper's CISA KEV table, e.g. CVE-2023-3595. At least one of technique_id, protocol, or cve_id is required."}],"responses":{"200":{"description":"STIX support level and actionability for the requested technique/protocol/CVE"},"402":{"description":"Payment required"}}}},"/ot/mitigation-map":{"get":{"summary":"D3FEND-Mapped Mitigation Guidance","description":"Prescriptive D3FEND-mapped mitigation guidance for OT/ICS threats. Pass one of actor, cve_id, or technique_id, optionally with vendor_stack. Returns matched ATT&CK ICS techniques mapped to D3FEND defensive countermeasures with priority and rationale, plus prescriptive architecture recommendations. DeepSeek-synthesised, ICD-203 estimative language.","operationId":"getMitigationMap","tags":["Architecture","D3FEND","MITRE ATT&CK","Mitigation"],"x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.20"}},"parameters":[{"name":"actor","in":"query","required":false,"schema":{"type":"string"},"description":"Threat actor name e.g. SANDWORM. At least one of actor, cve_id, or technique_id is required."},{"name":"cve_id","in":"query","required":false,"schema":{"type":"string"},"description":"CVE identifier. At least one of actor, cve_id, or technique_id is required."},{"name":"technique_id","in":"query","required":false,"schema":{"type":"string"},"description":"MITRE ATT&CK ICS technique ID e.g. T0836. At least one of actor, cve_id, or technique_id is required."},{"name":"vendor_stack","in":"query","required":false,"schema":{"type":"string"},"description":"Optional vendor/product context e.g. Schneider Modicon"}],"responses":{"200":{"description":"D3FEND-mapped mitigation guidance"},"402":{"description":"Payment required"}}}},"/ot/report":{"get":{"summary":"Full Threat Actor Report (Markdown)","description":"Synthesised Markdown threat report for an ICS/APT actor. Fans out to /ot/actor, /ot/campaign, /ot/malware, /ot/advisory, /ot/detection internally (no extra charge) and synthesises via DeepSeek. Returns executive summary, actor profile, active campaigns, malware families, sector targeting, ATT&CK mappings, recommended actions. TLP: WHITE.","operationId":"getActorReport","tags":["Composed","Report","Threat Actor"],"x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.25"}},"parameters":[{"name":"actor","in":"query","required":true,"schema":{"type":"string"},"description":"Actor name e.g. CHERNOVITE, SANDWORM, VOLTZITE, XENOTIME"},{"name":"sector","in":"query","required":false,"schema":{"type":"string"},"description":"Optional sector focus e.g. energy, water, manufacturing"}],"responses":{"200":{"description":"Threat actor report in Markdown"},"402":{"description":"Payment required"}}}},"/ot/dossier":{"get":{"summary":"Deep Actor Dossier","description":"Comprehensive intelligence dossier for an ICS threat actor. Fans out to /ot/actor, /ot/campaign, /ot/malware, /ot/ioc, /ot/asn, /ot/detection. Returns full profile, infrastructure analysis, IOC table, detection rules, kill chain mapping, and MITRE ATT&CK coverage.","operationId":"getActorDossier","tags":["Composed","Dossier","Threat Actor"],"x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.35"}},"parameters":[{"name":"actor","in":"query","required":true,"schema":{"type":"string"},"description":"Actor name e.g. SANDWORM, XENOTIME, VOLTZITE"}],"responses":{"200":{"description":"Deep actor intelligence dossier"},"402":{"description":"Payment required"}}}},"/ot/sitrep":{"get":{"summary":"Sector Situation Report","description":"30-day situation report for an industrial sector. Fans out to /ot/actor/sector, /ot/advisory, /ot/campaign, /ot/delta, /ot/compliance. Returns threat landscape, top active actors, new advisories, what changed, compliance posture impact, and weekly recommended priorities.","operationId":"getSectorSitrep","tags":["Composed","Sector","Report"],"x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.35"}},"parameters":[{"name":"sector","in":"query","required":true,"schema":{"type":"string"},"description":"energy | water | manufacturing | oil-and-gas | electric | nuclear | chemical"},{"name":"period","in":"query","required":false,"schema":{"type":"integer","default":30},"description":"Lookback days, default 30"}],"responses":{"200":{"description":"Sector situation report in Markdown"},"402":{"description":"Payment required"}}}},"/ot/article":{"get":{"summary":"CTI Article (Publication-Ready)","description":"Publication-ready threat intelligence article (~700 words). Fans out to /ot/actor or /ot/cve + /ot/campaign + /ot/malware + /ot/advisory. DeepSeek writes in journalistic CTI style with headline, lede, body, defanged IOCs, and TLP marking. Suitable for threat intel blog posts or advisories.","operationId":"getCtiArticle","tags":["Composed","Content","Article"],"x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.45"}},"parameters":[{"name":"actor","in":"query","required":false,"schema":{"type":"string"},"description":"Actor name e.g. CHERNOVITE (required if no cve)"},{"name":"cve","in":"query","required":false,"schema":{"type":"string"},"description":"CVE ID e.g. CVE-2024-12345 (required if no actor)"},{"name":"sector","in":"query","required":false,"schema":{"type":"string"},"description":"Optional sector context"}],"responses":{"200":{"description":"CTI article as structured JSON with markdown body"},"402":{"description":"Payment required"}}}},"/ot/linkedin":{"get":{"summary":"LinkedIn Post for CTI/ICS Audience","description":"LinkedIn post for a CTI/ICS security audience. Fans out to /ot/actor or /ot/cve + /ot/advisory. Returns hook line, 3-5 intelligence bullet observations, call to action, and hashtags. Ready to publish.","operationId":"getLinkedinPost","tags":["Composed","Content","LinkedIn"],"x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.15"}},"parameters":[{"name":"actor","in":"query","required":false,"schema":{"type":"string"},"description":"Actor name e.g. VOLTZITE (required if no cve)"},{"name":"cve","in":"query","required":false,"schema":{"type":"string"},"description":"CVE ID (required if no actor)"}],"responses":{"200":{"description":"LinkedIn post text with hashtags"},"402":{"description":"Payment required"}}}},"/ot/xpost":{"get":{"summary":"X/Twitter Thread (5-7 Posts)","description":"X/Twitter thread for an actor or CVE. Fans out to /ot/actor or /ot/cve. Returns 5-7 posts: hook, intel posts with ATT&CK IDs and affected systems, mitigation post, and hashtag post. Each post under 280 characters.","operationId":"getXThread","tags":["Composed","Content","Twitter"],"x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.10"}},"parameters":[{"name":"actor","in":"query","required":false,"schema":{"type":"string"},"description":"Actor name e.g. XENOTIME (required if no cve)"},{"name":"cve","in":"query","required":false,"schema":{"type":"string"},"description":"CVE ID (required if no actor)"}],"responses":{"200":{"description":"X thread as array of posts"},"402":{"description":"Payment required"}}}},"/ot/analyst-brief":{"get":{"summary":"Analyst Brief (BLUF)","description":"Human-readable analyst brief: BLUF, key judgments, and ICD-203 confidence assessment for a threat actor, optionally scoped to a sector. Same fan-out data as /ot/report but synthesised into a short decision-ready brief instead of a full report.","operationId":"getAnalystBrief","tags":["Composed","Actor","Brief"],"x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.12"}},"parameters":[{"name":"actor","in":"query","required":true,"schema":{"type":"string"},"description":"ICS threat actor name e.g. SANDWORM, VOLTZITE, XENOTIME"},{"name":"sector","in":"query","required":false,"schema":{"type":"string"},"description":"Optional target sector e.g. energy, water, manufacturing"}],"responses":{"200":{"description":"BLUF-style analyst brief with key judgments and confidence"},"402":{"description":"Payment required"}}}},"/ot/vendor-risk-delta":{"get":{"summary":"Vendor-Swap Risk Comparison","description":"Counterfactual vendor-swap risk comparison. Runs the same assessment used by /ot/vendor-risk on each vendor and returns the risk-tier delta plus per-vendor summaries, for pre-purchase or migration decisions.","operationId":"getVendorRiskDelta","tags":["Vendor","Risk","Supply Chain"],"x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.20"}},"parameters":[{"name":"vendor_current","in":"query","required":true,"schema":{"type":"string"},"description":"Current OT/ICS vendor name e.g. Siemens"},{"name":"vendor_proposed","in":"query","required":true,"schema":{"type":"string"},"description":"Proposed replacement vendor name e.g. Schneider Electric"},{"name":"product_current","in":"query","required":false,"schema":{"type":"string"},"description":"Optional current product line e.g. SIMATIC"},{"name":"product_proposed","in":"query","required":false,"schema":{"type":"string"},"description":"Optional proposed product line e.g. Modicon"}],"responses":{"200":{"description":"Risk-tier delta and per-vendor summaries"},"402":{"description":"Payment required"}}}},"/ot/sighting/submit":{"get":{"summary":"Submit OT Sighting","description":"Submit an anonymized IOC/TTP sighting observed in the caller's own OT environment. Feeds the correlation corpus without storing an org identifier. Written to a separate sightings store, not intel.db.","operationId":"submitSighting","tags":["Sighting","Crowdsourced","IOC"],"x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.05"}},"parameters":[{"name":"ioc_or_ttp_id","in":"query","required":true,"schema":{"type":"string"},"description":"CVE ID, MITRE ATT&CK-for-ICS technique ID, or sha256 hash"},{"name":"sector","in":"query","required":true,"schema":{"type":"string"},"description":"Sector where this was observed e.g. energy, water"},{"name":"region","in":"query","required":true,"schema":{"type":"string"},"description":"Region where this was observed e.g. KSA, UAE"},{"name":"actor_name","in":"query","required":false,"schema":{"type":"string"},"description":"Optional actor name if the sighting is attributed"},{"name":"observed_at","in":"query","required":false,"schema":{"type":"string"},"description":"Optional ISO 8601 timestamp of observation"}],"responses":{"200":{"description":"Sighting accepted and recorded"},"402":{"description":"Payment required"}}}},"/ot/gcc-bulletin":{"get":{"summary":"GCC OT Threat Sitrep (Public Bulletin)","description":"Recurring public 'State of OT Threat Intel — GCC' sitrep, human-reviewed before publish, sourced from the same intel.db pipeline as /ot/sitrep.","operationId":"getGccBulletin","tags":["Composed","Sector","Report"],"x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.01"}},"parameters":[{"name":"issue_date","in":"query","required":false,"schema":{"type":"string"},"description":"Optional YYYY-MM-DD of a past edition; defaults to latest reviewed edition"}],"responses":{"200":{"description":"GCC OT threat sitrep bulletin"},"402":{"description":"Payment required"}}}}}}